UpdraftCentral key theft leads to WordPress backdoor attacks

Attackers have exploited stolen UpdraftCentral connection keys to install backdoors on WordPress websites. The breach occurred following an intrusion into the TeamUpdraft website during the weekend of October 17–18.

The stolen keys, which facilitate remote management for UpdraftCentral, UpdraftVault, and UpdraftClone, allow unauthorized users to send signed commands to connected sites. These commands trigger the installation of malicious plugins, often disguised as maintenance tools like ‘Site Health Cache’. Once installed, these plugins create accounts with editor privileges, bypass two-factor authentication (2FA), and remain active even after the plugin is deleted.

TeamUpdraft reported that the breach resulted in the theft of customer data, including names, email addresses, billing addresses, order histories, password hashes, and 2FA settings. Payment information remains secure with Stripe and PayPal. The company has since closed the access route, logged out accounts, and is working to rotate affected keys and release hotfixes to deactivate older, compromised credentials.